Historical Graph for System Stats

This topic is for 11.4.1 -- see ASOC-87727 for details. Issue is we need a new CSH topic, but we cannot get the new topic URL until after we publish the topic to NetWitness Link. So, for 11.4, this is a duplicate topic. We can use the URL to update the mapping files: this will allow the team to test and make sure the help link works.

First posted topic here: DOC-110201. Then, somehow, seems to have been posted again here: https://community.rsa.com/docs/DOC-110188 --> I deleted this topic.

Note: The information in this topic applies to NetWitness Version 11.4.1 and later.

Historical system statistics are available for each event source.

To access the Historical Graph for the System Stats:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Event Sources.

    The Event Sources view is displayed.

  2. Click the Manage tab.

    The Event Sources Manage tab is displayed.

  3. In the Historical Graph column, select the view chart icon (netwitness_histgraph.png) for any listed event source.

    The Historical graph for the selected event source is displayed. The figure displays event source activity.

    netwitness_1141_histgraphesm.png

Parameters

You can customize the graph view as required. The table lists the various parameters used to customize the historical graph view.

Parameter Description

Log Collector

Select the Log Collector for which you want to view historical data. In some cases, the historical data for an event source may be spread across multiple Log Collectors.

Time Frame

Select the time frame for which you want to view the historical data.
The available options are: Current Day, Current Week, Current Month, and Current Year.

From <date> To <date>

Select the date range for which you want to view the historical data.

You can zoom in for a detailed view of the data in the Historical graph.

Examples of Zooming In

You can select one of the values to view the historical data for the selected value. The figure below displays an example for the 6 hour frame selected for zoom in. The slider bar at the right bottom corner is also changed to a 6 hour window.

Alternatively, you can slide the bar in the right hand corner to zoom in to a required frame.

netwitness_1141_zoomslidebar_750x424.png

You can click and drag in the plot area to zoom in for a required frame of time.

The figure below displays an example of how the graph appears while you click and drag.

netwitness_1141_zoomdrag_750x422.png